# Wildcard TLS Certificate for the Cilium Gateway listener.
#
# Split from clusters/_template/bootstrap-kit/01-cilium.yaml in
# fix/cilium-cert-split-from-bootstrap-kit (Phase-8a bug #13). The
# Cert lives in its OWN Flux Kustomization (`sovereign-tls`) which
# depends on bootstrap-kit being Ready — i.e. cert-manager + the
# powerdns-webhook are both installed and their CRDs registered.
#
# Without this split, Flux's server-side dry-run on the bootstrap-kit
# Kustomization fails with `no matches for kind "Certificate" in
# version "cert-manager.io/v1"` because the validation runs BEFORE any
# HelmRelease has installed the cert-manager CRDs — and a single
# dry-run failure aborts the entire Kustomization apply, leaving the
# Sovereign with zero HRs reconciled.
#
# The Gateway resource stays in 01-cilium.yaml: Gateway.networking.k8s.io
# CRDs ship with Cilium itself (gatewayAPI.enabled=true) and dry-run
# against them only requires the Gateway API CRD bundle which Cilium
# pre-installs at chart-time. The Certificate is the ONLY resource
# whose CRD is provided by a HelmRelease in the same Kustomization
# that needs to validate it.
#
# Issuer: `letsencrypt-dns01-prod-powerdns` is shipped by
# bp-cert-manager-powerdns-webhook (bootstrap-kit slot 49). It writes
# the ACME challenge TXT record to contabo's central PowerDNS at
# https://pdns.openova.io (authoritative for omani.works) so Let's
# Encrypt validation succeeds even before the Sovereign's own NS
# delegation has propagated. Replaces the previous letsencrypt-dns01-prod
# (dynadot-webhook-backed) — Dynadot is not the API-level authority for
# omani.works subdomains. Caught live on otech43–46.
#
# ──────────────────────────────────────────────────────────────────────────
# Multi-zone Sovereign (issue #827, parent epic #825) coexistence note
# ──────────────────────────────────────────────────────────────────────────
# bp-catalyst-platform 1.4.0+ ships templates/sovereign-wildcard-certs.yaml
# which renders one Certificate PER ENTRY in `.Values.parentZones`, each
# named `sovereign-wildcard-tls-<sanitised-zone>` (e.g.
# `sovereign-wildcard-tls-omani-trade`). Those resource names are DISTINCT
# from this file's `sovereign-wildcard-tls` so the two paths never collide:
#   - Single-zone Sovereigns (parentZones empty) — this file owns the only
#     wildcard cert.
#   - Multi-zone Sovereigns (parentZones populated) — this file STILL owns
#     `sovereign-wildcard-tls` (covering the operator's primary parent
#     zone) AND the chart adds N additional zone-specific certs. The
#     Cilium Gateway listener is updated in the per-cluster overlay to
#     reference the appropriate Secret per zone listener.
#
# Once issue #831 lands a multi-listener Gateway template in
# bp-catalyst-platform itself, this file becomes redundant and is
# deletable.

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: sovereign-wildcard-tls
  namespace: kube-system
  labels:
    catalyst.openova.io/sovereign: ${SOVEREIGN_FQDN}
    catalyst.openova.io/component: cilium-gateway
spec:
  secretName: sovereign-wildcard-tls
  issuerRef:
    name: letsencrypt-dns01-prod-powerdns
    kind: ClusterIssuer
  commonName: "*.${SOVEREIGN_FQDN}"
  dnsNames:
    - "*.${SOVEREIGN_FQDN}"
    - "${SOVEREIGN_FQDN}"
